Vehicular system, ecu, storing instruction transmission device, and storing request transmission device

ABSTRACT

A vehicular system includes a master ECU, a first slave ECU, and a second slave ECU. The second slave ECU transmits a storing request to the master ECU on detection of a malfunction. The master ECU transmits a storing instruction for causing diagnostic information to be stored, on reception of the storing request. The first slave ECU generates diagnostic information on the first slave ECU, on reception of the storing instruction from the master ECU. The first slave ECU further stores the generated diagnostic information in a retention storage medium. The retention storage medium is configured to retain validity determination information in a condition where the first slave ECU is not supplied with electric power source.

CROSS REFERENCE TO RELATED APPLICATION

This application is based on Japanese Patent Applications No. 2011-61098filed on Mar. 18, 2011 and No. 2012-7346 filed on Jan. 17, 2012, thedisclosure of which is incorporated herein by reference.

TECHNICAL FIELD

The present disclosure relates to a vehicular system, an electroniccontrol unit (ECU), a storing instruction transmission device, and astoring request transmission device.

BACKGROUND

For example, JP-A-2003-229873 discloses a conventional vehicular systemincluding multiple electronic control units (ECUs). In the configurationof JP-A-2003-229873, when a certain ECU detects a malfunction,diagnostic information on the ECU is stored in a storage medium, and thestored diagnostic information is read by using a diagnostic tool at arepair shop of the vehicle.

In view of a complicated control system in a vehicle in recent years,new configuration for identifying a malfunction is demanded.

SUMMARY

It is an object of the present disclosure to enable an ECU to storediagnostic information on detection of a malfunction in another certainECU in a vehicular system equipped with multiple ECUs.

In recent years, control systems in a vehicle have been complicated. Theinventors of the present disclosure have studied recent vehicularcontrol systems and consequently focused on multiple ECUs cooperatingbilaterally in recent vehicular systems to control vehicular devices. Insuch a complicated system, for example, when a certain ECU detects amalfunction, It may be insufficient for specifying the cause of themalfunction only with diagnostic information of the certain ECU.

In consideration of the study result, according to an aspect of thepresent disclosure, a vehicular system equipped to a vehicle, thevehicular system comprises a master ECU. The vehicular system furthercomprises a first slave ECU. The vehicular system further comprises asecond slave ECU. The second slave ECU is configured to transmit astoring request to the master ECU on detection of a malfunction. Themaster ECU is configured to transmit a storing instruction on receptionof the storing request. The first slave ECU is configured, on receptionof the storing instruction from the master ECU: to generate diagnosticinformation on the first slave ECU; and to store the generateddiagnostic information in a retention storage medium, the retentionstorage medium being configured to retain validity determinationinformation in a condition where the first slave ECU is not suppliedwith electric power.

According to another aspect of the present disclosure, a vehicularsystem equipped to a vehicle, the vehicular system comprises a firstECU. The vehicular system further comprises a second ECU. The first ECUis configured to transmit a storing instruction on detection of amalfunction. The second ECU is configured, on reception of the storinginstruction transmitted from the first ECU: to generate diagnosticinformation on the second ECU; and to store the generated diagnosticinformation on the second ECU in a retention storage medium, theretention storage medium being configured to retain validitydetermination information in a condition where the second ECU is notsupplied with electric power.

According to another aspect of the present disclosure, an ECU equippedto a vehicle, the ECU configured, on reception of a storing instructionfrom an outside: to generate diagnostic information on the ECU; and tostore the generated diagnostic information in a retention storagemedium, the retention storage medium being configured to retain validitydetermination information in a condition where the ECU is not suppliedwith electric power.

According to another aspect of the present disclosure, a storinginstruction transmission device configured to transmit a storinginstruction to a vehicular ECU, the vehicular ECU being configured, onreception of the storing instruction from an outside: to generatediagnostic information on the storing instruction transmission device;and to store the generated diagnostic information in a retention storagemedium, the retention storage medium being configured to retain validitydetermination information in a condition where the storing instructiontransmission device is not supplied with electric power.

According to another aspect of the present disclosure, an ECUcommunicable with a storing instruction transmission device, the ECUcomprises a storing request transmission unit configured, on detectionof an anomaly by the ECU, to transmit a first storing request, whichincludes a first system identification code corresponding to theanomaly, to a storing instruction transmission device thereby to causethe storing instruction transmission device to transmit a first storinginstruction, which includes the first system identification code. TheECU further comprises an instruction correspondence storing unitconfigured: to receive a second storing instruction, when the storinginstruction transmission device transmits the second storing instructionon reception of a second storing request from a device other than theECU; to determine whether to store diagnostic information on the ECU,according to a second system identification code included in thereceived second storing instruction; and to store diagnosticinformation, which includes data corresponding to the second systemidentification code, in a storage medium of the ECU, on determination tostore.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objects, features and advantages of the presentdisclosure will become more apparent from the following detaileddescription made with reference to the accompanying drawings. In thedrawings:

FIG. 1 is a block diagram showing a vehicular system according to anembodiment;

FIG. 2 is a view showing the contents of a vehicle local time;

FIG. 3 is a flowchart showing a vehicle local time generation andtransmission processing implemented by a master ECU;

FIG. 4 is a flowchart showing an exchange and record processingimplemented by a slave ECU;

FIG. 5 is a flowchart showing an exchange and record processingimplemented by the slave ECU;

FIG. 6 is a graph showing transition of elapsed time information andvalidity determination information with elapse of the time;

FIG. 7 is a timing chart showing operation of ECUs;

FIG. 8 is a view showing the contents of a simultaneous storing request;

FIG. 9 is a flow chart showing a part of the exchange and recordprocessing in FIG. 4;

FIG. 10 is a view showing one example of a belonging group list;

FIG. 11 is a view showing an example of a data configuration of a storeddata correspondence table; and

FIG. 12 is a view showing a configuration of a vehicular systemaccording to another embodiment.

DETAILED DESCRIPTION

As follows, an embodiment of the disclosure will be described. FIG. 1 isa block diagram showing a vehicular system 1 according to the presentembodiment. The vehicular system 1 is equipped to a vehicle forcontrolling vehicular devices such as a safety device, a power train, abrake mechanism, an airbag, a convenience and comfortable controldevice, equipped to the vehicle.

The vehicular system 1 includes an electronic control unit (ECU), suchas a master ECU 11 and multiple slave ECUs 12 to 14. The vehicularsystem 1 further includes an in-vehicle LAN 15, such as CAN or FlexRay,as a communication line for communication among the ECUs 11 to 14. TheECUs 11 to 14 are communicable with each other through the in-vehicleLAN 15.

The master ECU 11 generates information, such as a vehicle local timeand a simultaneous storing instruction (described later), and transmitsthe generated information to the slave ECUs 12 to 14 and the likeperiodically and repeatedly through the in-vehicle LAN 15. The slaveECUs 12 to 14 use the vehicle local time transmitted from the master ECU11 as an inner time of the self device. The slave ECUs 12 to 14 furthertransmit a simultaneous storing request to the master ECU 11, ondetection of a malfunction. The slave ECUs 12 to 14 further storediagnostic information on reception of a simultaneous storing requestfrom the master ECU 11.

The master ECU 11 is a +B system activated with backup electric powerfrom a battery in both an ON state (IG-ON state) and an OFF state(IG-OFF state) of an ignition device (IG) of the vehicle. The ignitiondevice (IG) of the vehicle is one example of a main power source of thevehicle. In the present embodiment, the master ECU 11 may be a main bodyECU for controlling a vehicular device such as a head lamp and/or aninterior light. The present configuration may be employed, since themain body ECU is a +B system with high loading rate in a vehicle andincludes a retention storage medium. The retention storage medium is,for example, a non-volatile storage media, such as a flash memory,S-RAM, etc., and configured to retain the validity determinationinformation, even when the ECU equipped with the retention storagemedium is not supplied with electric power.

Each of the slave ECUs 12 to 14 may be the +B system. Alternatively,each of the slave ECUs 12 to 14 may be an IG system activated withelectric power from the battery when the vehicle is in the IG-ON state,and terminated without electric power from the battery when the vehicleis in the IG-OFF state. Alternatively, each of the slave ECUs 12 to 14may be an ACC system activated with electric power from the battery whenan airconditioner of the vehicle is activated in an ACC-ON state, andterminated without electric power from the battery when theairconditioner of the vehicle is deactivated in an ACC-OFF state.

In the present embodiment, it is assumed that the slave ECU 12 and theslave ECU 13 are for controlling a power train of the vehicle, and theslave ECU 13 is for controlling a device of a body system of thevehicle. The ECU for controlling the power train may be, for example, anengine ECU and/or a transmission ECU. The engine ECU is for controlling,for example, fuel supply to an engine, a fuel injection timing, and/orthe like. The transmission ECU is for controlling, for example, atransmission device. The device of a body system belongs to aconvenience and comfortable control device, such as a door lock system,a door mirror angle adjustment mechanism, and/or the like.

Each of the ECUs 11 to 14 has a hardware configuration including, forexample, a communication interface circuit communicable with thein-vehicle LAN 15, the retention storage media such as a flash memory,and a control circuit.

The control circuit is configured with a generally-known microcomputerequipped with a CPU, a volatile storage medium such as a RAM and a ROM,a timer, and an I/O device. The CPU executes a program stored in theROM, arbitrary write data in and read data from the RAM as the retentionstorage medium, and causes a communication interface circuit toimplement communications through the in-vehicle LAN 15. The CPU furtherreceives a detection signal from a sensor (not shown) arbitrary, andcontrols an actuator (not shown) being a control object.

For example, the master ECU 11 receives a detection signals from devicessuch as a head lamp operation unit, an interior light operation unit,and/or a sensor, such as a door opening-and-closing sensor for detectingopening and closing of a door. The head lamp operation unit is operatedby a driver in order to switch activation and deactivation of a headlamp. The interior light operation unit is operated by a driver in orderto switch activation and deactivation of an interior light and automaticcontrol of the interior light. The master ECU 11 further controls thehead lamp as an actuator according to the detection signal received fromthe head lamp operation unit and controls the interior light as anactuator according to the detection signal received from the interiorlight operation unit and the door opening-and-closing sensor.

For example, the slave ECU 12 receives detection signals from sensors,such as an accelerator position sensor, an engine coolant temperaturesensor, an engine revolution sensor, and/or a vehicle speed sensor. Theslave ECU 12 further controls an engine throttle valve control mechanismand a fuel injection mechanism as actuators, according to the detectionsignal retrieved from these sensors.

For example, the slave ECU 13 receives detection signals from sensors,such as the vehicle speed sensor, a drive range sensor, and the enginerevolution sensor. The slave ECU 13 further controls the transmissiondevice as an actuator, according to the detection signals received fromthese sensors.

For example, the slave ECU 14 receives detection signals from sensors,such as the door lock operation unit and a mirror angle adjustmentdevice. The slave ECU 14 controls the door lock system and the doormirror angle adjustment mechanism as actuators, according to thedetection signal received from these sensors.

In the following description, a processing implemented by a CPU of acontrol circuit in an ECU is referred to as a processing implemented bythe ECU.

In the present embodiment, the vehicle local time is uniformly used ineach of the ECUs 11 to 14 of the vehicular system 1. The vehicle localtime is periodically and repeatedly generated by the master ECU 11 andperiodically and repeatedly transmitted from the master ECU 11 to theslave ECUs 12 to 14. When recording diagnostic information, the masterECU 11 and the slave ECUs 12 to 14 associate the diagnostic informationwith the latest vehicle local time and store the associated diagnosticinformation and the latest vehicle local time.

The pair of the diagnostic information and the vehicle local time, whichare associated and stored in each of the ECUs 11 to 14, is transmittedfrom each of the ECUs 11 to 14 to a diagnostic tool 2 through thein-vehicle LAN 15, when the diagnostic tool 2 is connected to thein-vehicle LAN 15 in a repair shop or the like (describes later).

As shown in FIG. 2, the master ECU 11 stores data about a vehicle localtime 20 in a storage medium, such as the RAM and the retention storagemedium. Specifically, the vehicle local time 20 includes elapsed timeinformation 21 and validity determination information 22. The master ECU11 stores the elapsed time information 21 in the RAM and stores thevalidity determination information 22 in the retention storage medium.

The elapsed time information 21 is 22-bit length data for measurement ofthe elapsed time information and configured to increment by one-secondunit, as the time elapses in cycle order. The elapsed time information21 has the least significant bit (LSB) representing one second. Thevalidity determination information 22 is 2-bit length data configured toincrement by one on one reset of the master ECU 11 in cycle order.Specifically, the validity determination information 22 increments byone on one reset of the CPU of the control circuit of the master ECU 11.The validity determination information 22 has the least significant bit(LSB) representing one reset.

As follows, the configuration of the diagnostic tool 2 will bedescribed. The diagnostic tool 2 includes a communication interfaceunit, an operation unit, a display device, a time counter device, and acontrol circuit. The communication interface unit is for connecting withthe in-vehicle LAN 15 to communicate with the ECUs 11 to 14. Theoperation unit accepts a user's operation on a device, such as a button.The display device indicates information. The time counter devicemeasures an absolute time. The absolute time may be a calendar time,which includes the year, the month, the day, the hour, the minute, andthe second. The absolute time may be the Coordinated Universal Time(UTC) and/or the like.

The control circuit is configured with a generally-known microcomputerequipped with a CPU, a RAM, a ROM, and an I/O device. The CPU executes aprogram stored in the ROM, arbitrary write data in and read data fromthe RAM as the retention storage medium, and causes the communicationinterface circuit to implement communications with the ECUs 11 to 14through the in-vehicle LAN 15. The CPU further receives a signal causedby user's operation on the operation unit, causes the display device toindicate information, and receives the present absolute time from thetime counter device, thereby to produce specific operation (describedlater. As follows, the processing implemented by the CPU will bereferred to as a processing implemented by the diagnostic tool 2.

It is noted that, the vehicular system 1 does not include a time counterdevice, such as a GPS receiver, a radio-controlled clock, and a quartzwatch, for measuring the absolute time. Alternatively, even when thevehicular system 1 is equipped with a time counter device for measuringthe absolute time, the vehicular system 1 does not use the time counterdevice.

As follows, operation of the vehicular system 1 will be described. Themaster ECU 11 causes the CPU to execute a predetermined program therebyto implement a vehicle local time generation and transmission processingshown in FIG. 3. The master ECU 11 starts the vehicle local timegeneration and transmission processing in both cases immediately afterthe master ECU 11 is reset and immediately after the main power source(IG) of the vehicle is switched from the OFF state into ON state. Thecase where the master ECU 11 is reset may be caused when the processingof the master ECU 11 is reset by a fail-safe processing. The case wherethe master ECU 11 starts its operation occurs when, for example, themaster ECU 11 is disconnected from the battery of the vehicle, andthereafter, the master ECU 11 is connected with the battery of thevehicle and activated.

Each of the slave ECUs 12 to 14 implements a reception and recordprocessing shown in FIG. 4 and FIG. 5 when the slave ECU starts itsoperation. Each of the master ECU 11 and the slave ECUs 12 to 14implements the processing in FIG. 4 and FIG. 5 in parallel with anotherprocessing, such as a processing for engine control, a processing forbrake control, and a processing for air-conditioning control.

When starting the operation of the vehicle local time generation andtransmission processing, at step 100, the master ECU 11 first triesreadout of the validity determination information 22 from the retentionstorage medium into the RAM or a register of the CPU. The register ofthe CPU is also an example of the volatile memory.

Subsequently, at step 103, the master ECU 11 determines whether thereadout is successful or failed. On determination of successful result,the processing proceeds to step 120 successively. Alternatively, ondetermination of failed result, the processing proceeds to step 105successively.

The failed result of the readout is caused when, for example, atemporary malfunction occurs due to glitch in the retention storagemedium, interfering wave, or the like. Normally, the readout issuccessful.

In the case of the successful result, at step 120, it is determinedwhether the present state is immediately after the master ECU 11 returnsfrom the reset state. When the master ECU 11 is reset, data stored inthe RAM will be lost. Therefore, the determination whether the presentstate is immediately after the master ECU 11 returns from the resetstate can be made, according to the contents in the RAM. Specifically,the determination can be made by determining whether, for example, theelapsed time information 21 is stored in the RAM. Alternatively, thedetermination can be made by determining whether the reset processinghas been implemented.

In general, the master ECU 11 is reset in a case where, for example, theprocessing of the master ECU 11 goes into an infinite loop to cause amalfunction. Normally, it is determined that the present state is notimmediately after returning from the reset state.

When it is determined that the present state is not immediately afterreturning from the reset state at step 120, the processing proceeds tostep 140. At step 40, the master ECU 11 writes a value of the validitydetermination information 22, which was read from the non-volatilestorage medium and stored in the RAM at step 100, in the retentionstorage medium. Thus, the processing proceeds to step 150.Alternatively, when it is determined that the present state is notimmediately after returning from the reset state at step 120, theprocessing may proceed to step 145 as it is.

At step 145, it is determined whether the simultaneous storing requestis received after executing step 145 at the last time before the presentexecution timing of step 145. It is noted that, in the case where it isthe first execution of step 145 after the master ECU 11 is started, itis determined whether the simultaneous storing request is received afterthe master ECU 11 is started before the present execution timing of step145. On determination that the simultaneous storing request is received,the processing proceeds to step 155 successively. Alternatively, ondetermination that the simultaneous storing request is not received, theprocessing proceeds to step 150 successively. As follows, the case wherethe processing proceeds to step 150 on determination that thesimultaneous storing request is not received will be described. Theprocessing on determination that the simultaneous storing request isreceived will be described later.

At step 150, it is determined whether a measured time of a timer housedin the control circuit reaches a predetermined reference time such as1000 milliseconds in the present embodiment. On determination that themeasured time does not reach the predetermined reference time, step 150is executed again. Alternatively, on determination that the measuredtime reaches the predetermined reference time, the processing proceedsto step 160.

The start point of the measured time is the time point when the measuredtime has reached the reference time at step 150 at the last time. It isnoted that, in the case where it has never been determined that themeasured time has reached the reference time at step 150 after startingthe processing in FIG. 3, the start point of the measured time is set atthe time point at which step 150 is first executed after the start ofthe processing in FIG. 3. In this way, the processing proceeds from step150 to step 160 each time when the reference time elapses.

At step 160 and subsequent steps, the value of the elapsed timeinformation 21 in the RAM is changed by the time unit according to theelapse of the time in cycle order. “The change in the cycle order” isimplemented such that the value of the 22-bit elapsed time information21 is incremented by one from its minimum value to its maximum value,and the value of the elapsed time information 21 is returned to theminimum value after the value of the elapsed time information 21 reachesthe maximum value. In the present embodiment, “the time unit accordingto the elapse of the time” is “one time unit by one second.”

Specifically, the master ECU 11 increments the value of the elapsed timeinformation 21 by one at step 160. It is noted that, in the case wherethe elapsed time information 21 is not stored in the RAM immediatelyafter starting of the master ECU 11 or immediately after returning fromthe reset state, the elapsed time information 21 with the minimum valueis stored in the RAM.

Subsequently, at step 170, it is determined whether the value of theelapsed time information 21 overflows. Specifically, when the elapsedtime information 21 is at the maximum value and when the elapsed timeinformation 21 is incremented by one, the value of the elapsed timeinformation 21 overflows. On determination that the value of the elapsedtime information 21 overflows, the elapsed time information 21 is set atthe minimum value at step 180, and thereafter, the processing proceedsto step 190. On determination that the value of the elapsed timeinformation 21 does not overflow at step 170, the processing skips step180 and proceeds to step 190.

At step 190, data is generated as a simultaneous storing instruction. Inthe present embodiment, the simultaneous storing instruction is 8-bitdata. It is noted that, the contents of the simultaneous storinginstruction being generated presently is a predetermined valuerepresenting a failure value. The simultaneous storing instruction maybe 8-bit data including eight bits all being set at “1.” Dissimilarly tothe simultaneous storing instruction generated at step 194 (describedlater), the present simultaneous storing instruction is not data forstoring diagnostic information.

At subsequent step 192, the vehicle local time 20 is generated toinclude the elapsed time information 21, which has the value changed bythe time unit according to the elapse of the time in the cycle order, asdescribed above, and the latest value of the validity determinationinformation 22 stored in the retention storage medium. Furthermore, thevehicle local time 20 and the simultaneous storing instruction generatedat step 190 are included in one data frame. Furthermore, the data frameis caused to include a predetermined address ID for broadcasting, sothat the data frame, which includes the vehicle local time 20 and thesimultaneous storing instruction, is received by all the ECUs includingthe slave ECUs 12 to 14, other than the master ECU 11, connected to thein-vehicle LAN 15. Furthermore, an interface circuit is caused to sendthe data frame into the in-vehicle LAN 15. Subsequently, the processingreturns to step S145. It is noted that, the transmission at step 192 isimplemented only when the vehicle is in the IG-ON state. When thevehicle is in the IG-OFF state, the transmission is not implemented, andthe processing returns to step 145.

In the exchange and record processing in FIG. 4 and FIG. 5, each of theslave ECUs 12 to 14 first waits for a predetermined time at step 210.Specifically, this predetermined time is, for example, 1000 millisecondsbeing same as a transmission interval at which the master ECU 11transmits the vehicle local time 10. In the meantime, each of the slaveECUs 12 to 14 causes the communication interface circuit to receive thedata frame, which includes the vehicle local time 20 and thesimultaneous storing instruction, transmitted from the master ECU 11through the in-vehicle LAN 15.

When the predetermined time elapses, the processing proceeds to step220. At step 220, the vehicle local time 20 included in the receiveddata frame is stored in the RAM and updated as the latest vehicle localtime 20 in the slave ECU.

Subsequently, at step 230, it is determined whether a storing eventoccurs. The storing event is a predetermined event at which thediagnostic information needs to be stored.

The storing event is determined to occur in two cases. One of the twocases is when the simultaneous storing instruction in the data framereceived at immediately preceding step 210 is not a failure value, thatis, when the simultaneous storing instruction, which is not failure invalue, is received at immediately preceding step 210.

The other one of the two cases is when a malfunction is determined tooccur according to the detection signal from the sensor and when themalfunction is determined to necessitate storing of the diagnosticinformation on the self device. For example, the malfunction may occurwhen the engine revolution deviates from its predetermined normal rangeor when the brake pressure deviates from its predetermined normal range.It is specified beforehand a malfunction necessitating storing of thediagnostic information on the self device and a malfunction notnecessitating storing of the diagnostic information on the self device.

In many cases, the storing event is determined not to occur. In thiscase, the processing proceeds to step 250 where it is determined whethertransmission of the simultaneous storing request is needed. Transmissionof the simultaneous storing request is determined to be needed when amalfunction is determined to occur according to the detection signalfrom the sensor and when the malfunction is determined to necessitatetransmission of the simultaneous storing request. It is specifiedbeforehand a malfunction necessitating transmission of the simultaneousstoring request and a malfunction not necessitating transmission of thesimultaneous storing request. In many cases, transmission of thesimultaneous storing request is determined not to be needed. In thiscase, the processing returns to step 210.

As described above, in the IG-ON state when being communicable with themaster ECU 11, each of the slave ECUs 12 to 14 receives the data frame,which includes the vehicle local time 20, from the master ECU 11periodically (step 210) and synchronizes the inner time with the vehiclelocal time 20 (step 220). In addition, each of the slave ECUs 12 to 14does not implement a processing to change the vehicle local, time 20 byitself.

With the fundamental operation of the master ECU 11 and the slave ECUs12 to 14 in this way, the vehicle local time 20 is sent from the masterECU 11 and received by the slave ECUs 12 to 14 repeatedly andperiodically at the cycle of 1000 millisecond. As shown in the timeperiod from the time t0 to the time t1 in the graph in FIG. 6, theelapsed time information 21 of the vehicle local time 20 increases byone relative to the elapse of one second at the constant increase ratein proportion to the elapse of the time.

Herein, it is assumed that the master ECU 11 is reset at the time t1 inthe state where no slave ECUs 12 to 14 transmits the simultaneousstoring request. In this case, the master ECU 11 stops its processing inthe course of the vehicle local time generation and transmissionprocessing in FIG. 3. Consequently, the elapsed time information 21 islost from the RAM. Subsequently, the master ECU 11 returns from thereset state immediately and again begins the vehicle local timegeneration and transmission processing in FIG. 3.

In the present state, the readout of the validity determinationinformation 22 is usually successful at step 100, it is determined thatthe readout is successful at subsequent step 103, and it is determinedthat the present state is immediately after returning from the resetstate at subsequent step 120. Thus, the processing proceeds to step 125.

At step 125 and subsequent steps, the value of the validitydetermination information 22 is changed in the cycle order. “The changein the cycle order” is implemented such that the value of the 2-bitvalidity determination information 22 is incremented by one from itsminimum value to its maximum value, and the value of the validitydetermination information 22 is returned to the minimum value after thevalue of the validity determination information 22 reaches the maximumvalue.

Specifically, at step 125, the validity determination information 22readout at step 100 is incremented by one. Subsequently, at step 130, itis determined whether the validity determination information 22overflows. Specifically, when the validity determination information 22is at the maximum value and when the validity determination information22 is incremented by one, the value of the validity determinationinformation 22 overflows. On determination that the value of thevalidity determination information 22 overflows, the validitydetermination information 22 is set at the minimum value at step 130,and thereafter, the processing proceeds to step 140. On determinationthat the value of the validity determination information 22 does notoverflow, the processing skips step 135 and proceeds to step 140.

At step 140, the validity determination information 22 after beingchanged and stored in the RAM is stored as the latest value of thevalidity determination information 22 in the retention storage medium.In this way, at the time t1 in FIG. 5, the value of the validitydetermination information 22 changed by one is updated as the latestvalue of the validity determination information 22 in the retentionstorage medium.

At step 145 subsequent to step 140, it is determined that thesimultaneous storing request is not received. Subsequently, theprocessing proceeds to step 150 at which the processing waits until themeasured time reaches 1000 milliseconds. At step 160, the elapsed timeinformation 21 is not stored in the RAM, since it is immediately afterthe master ECU 11 returns form the reset state. Therefore, the value ofthe elapsed time information 21 at its minimum value (namely, initialvalue) is newly stored in the RAM. Subsequently, at step 170, it isdetermined that the value of the elapsed time information 21 does notoverflow. At step 190, the simultaneous storing request, which includesthe failure value, is generated. At step 192, the vehicle local time 20,which includes the elapsed time information 21 being set in theabove-described way and the validity determination information 22, andthe simultaneous storing request are included into one data frame. Thus,the data frame is transmitted.

Subsequent to the time t1, the master ECU 11 and the slave ECUs 12 to 14implement the above-described fundamental operation. Thus, as shown inFIG. 6, the elapsed time information 21 increases, with the elapse ofthe time, while the validity determination information 22 is constant inthe ECUs 11 to 14.

It is noted that, even in the case where the vehicle is in the IG-OFFstate to disable communications through the in-vehicle LAN 15, themaster ECU 11 is in operation to implement the processing in FIG. 3.Thus, the master ECU 11 continues the change in the value of the elapsedtime information 21 by the time unit according to the elapse of the time(steps 160 to 180). In addition, the master ECU 11 continues the changein the value of the validity determination information 22 according tooccurrence of reset (steps 120 to 140). Therefore, the vehicle localtime 20 changes with the elapse of the time in the same form when thevehicle is in the IG-ON state. In the following description, a seriestime period, in which the validity determination information 22 isconstant to have the same value, is referred to as a time group.

Herein, it is assumed that the storing event occurs in the slave ECU 12at the time t2. Specifically, it is assumed that, at step 230, the slaveECU 12 determines that the engine coolant temperature exceeds itsallowable range according to the detection signal from the enginecoolant temperature sensor and determines that a malfunction occurs. Inaddition, it is assumed that the slave ECU 12 determines that themalfunction necessitates storing of the diagnostic information by theself device. In this case, the slave ECU 12 determines that the storingevent occurs, and the processing proceeds to step 240.

In this case, the diagnostic information on the self device is generatedat step 240. Further, the diagnostic information is associated with thelatest vehicle local time 20 stored in the RAM, and the associatedinformation is stored in the retention storage medium. In the vehiclelocal time 20 stored with the diagnostic information presently, thevalue of the elapsed time information 21 corresponds to the elapsed timed0 in FIG. 6, and the value of the validity determination information 22is 03.

The diagnostic information stored presently includes a diagnosis troublecode (DTC) and a freeze frame data (FFD). The DTC is a malfunctionclassification code representing the classification of the malfunctionrelated to the high temperature of engine cooling water. The FFD mayinclude data related to, for example, the detected engine coolanttemperature.

Subsequent to step 240, the proceeds to step 250, at which it isdetermined whether the simultaneous storing request is needed. In thepresent example, it is assumed that the detected malfunction does notneed transmission of the simultaneous storing request. In this case, theprocessing returns to step S210.

Subsequent to the time t2, the master ECU 11 and the slave ECUs 12 to 14implement the above-described fundamental operation. Thus, the elapsedtime information 21 increases with the elapse of the time, while thevalidity determination information 22 is constant in the ECUs 11 to 14.

Subsequently, at the time t3, it is assumed that the elapsed timeinformation 21 reaches the maximum value, and after the elapse of 1000milliseconds, it is assumed that overflow occurs at step 160 in thevehicle local time generation and transmission processing in FIG. 3. Inthis case, the master ECU 11 determines that the overflow occurs at step170. Subsequently, the processing proceeds to step 180 at which theelapsed time information 21 is set at the minimum value. In this case,the elapsed time information 21 does not change.

In consideration of that the elapsed time information 21 is the 22-bitlength date, and its LSB is equivalent to 1 second, the length of thetime period from the time t1, at which the elapsed time information 21changes from the minimum value to the maximum value, to the time t3, isabout 48.5 days.

Subsequent to the time t3, the master ECU 11 and the slave ECUs 12 to 14implement the above-described fundamental operation. Thus, the elapsedtime information 21 increases from the minimum value with the elapse ofthe time, while the validity determination information 22 is constant inthe ECUs 11 to 14.

Thereafter, it is assumed that the master ECU 11 is reset at the timet4. In this case, the master ECU 11 proceeds the processing to step 125similarly to the case at the time t1, and increments the value of thevalidity determination information 22, which is readout at step 100, byone. The value of the validity determination information 22 before thepresent increment is the maximum value (03). Therefore, the validitydetermination information 22 overflows by the present increment. Inresponse to this, at step 130, the master ECU 11 determines that thevalue of the validity determination information 22 overflows. Thus, theprocessing proceeds to step 130, at which the value of the validitydetermination information 22 is set to the minimum value (00), and theprocessing proceeds to step 140. The processing subsequent to step 140is similar to those in the case of the time t1.

Subsequent to the time t4, the master ECU 11 and the slave ECUs 12 to 14implement the above-described fundamental operation. Thus, the elapsedtime information 21 increases from the minimum value with the elapse ofthe time, while the validity determination information 22 is constant inthe ECUs 11 to 14.

Thereafter, it is assumed that the engine revolution exceeds itsallowable range in the time zone t5. FIG. 7 shows the operation of theECUs 11 to 14 and the transition of the elapsed time information 21 withthe elapse of the time in the time zone t5 from the time t51 to the timet54.

At the time t51, with the above-described fundamental operation of themaster ECU 11 and the slave ECUs 12 to 14, the master ECU 11 implementsthe vehicle local time generation and the transmission processing inFIG. 3 and transmits the vehicle local time 20 (31 a). Further, theslave ECUs 12 to 14 implements the processing at step 210 in FIG. 4 andreceives the vehicle local time 20 (31 b to 31 d).

At the time t52 subsequent to the time t51, the slave ECU 13 detectsthat the engine revolution exceeds the allowable range at step 230 inFIG. 4. It is assumed that the malfunction that the engine revolutionexceeds the allowable range is specified beforehand in the slave ECU 13to necessitate storing of the diagnostic information by the self deviceand to necessitate transmission of the simultaneous storing request.Therefore, at the time t52, the slave ECU 13 determines, at step 230,that the engine revolution exceeds its allowable range according to thedetection signal from the engine revolution sensor and determines thatthe malfunction occurs. In addition, when the slave ECU 13 determinesthat the malfunction necessitates storing of the diagnostic informationby the self device, the processing proceeds to step 240.

In this case, the diagnostic information on the self device is generatedat step 240. Further, the diagnostic information is associated with thelatest vehicle local time 20 stored in the RAM, and the associatedinformation is stored in the retention storage medium (32 c-1). In thevehicle local time 20 stored with the diagnostic information presently,the value of the elapsed time information 21 corresponds to the elapsedtime d3 in FIG. 7, and the value of the validity determinationinformation 22 is 00. The diagnostic information stored presentlyincludes the DTC and the FFD. The DTC and the FFD to be stored aredetermined correspondingly to a malfunction.

At step 250 subsequent to step 240, the malfunction is determined tooccur according to the detection signal from the sensor, and themalfunction is determined to necessitate transmission of thesimultaneous storing request. Consequently, it is determined that thetransmission of the simultaneous storing request is necessitated, andthe processing proceeds to step 260 in FIG. 5 successively.

At step 260, it is determined whether the vehicle local time 20 isnormally received from the master ECU at immediately preceding step 210.In usual cases, it is determined that the vehicle local time 20 isnormally received from the master ECU. To the contrary, when it isdetermined that the vehicle local time 20 is not normally received dueto a malfunction, the processing is returned to step 210 and theprocessing waits for reception of the subsequent vehicle local time 20.

When it is determined that the vehicle local time 20 is normallyreceived, the processing proceeds to step 270 at which a systemidentification code and a malfunction classification code are generated.The system identification code and the malfunction classification codeare to be included in the simultaneous storing request transmitted tothe master ECU 11. The system identification code and the malfunctionclassification code are determined according to the classification ofthe malfunction detected at step 250.

Specifically, the system identification code is, for example, a 4-bitcode for specifying the classification of an ECU relevant to thedetected malfunction. The correspondence between the occurringmalfunction and the system identification code is beforehand specifieduniformly in each of the ECUs 11 to 14. For example, the value of thesystem identification code associated with each malfunction may be threevalues respectively representing three kinds of malfunctions in thepower train system, three values respectively representing three kindsof malfunctions in the brake mechanism system, and/or three valuesrespectively representing three kinds of malfunctions in the safetydevice system. Alternatively or in addition, the value of the systemidentification code associated with each malfunction may be three valuesrespectively representing three kinds of malfunctions in the convenienceand comfortable control device system and/or three values respectivelyrepresenting three kinds of malfunctions of all the ECU systems. In thepresent embodiment, it is assumed that the malfunction that the enginerevolution exceeds the allowable range is assigned to one of the valuesof the power train system. Therefore, at present step 270, the systemidentification code representing the one value of the power train systemis generated.

The malfunction classification code is, for example, a 4-bit code forspecifying the detected malfunction uniquely. Determination of thecombination of the occurring malfunction, the system identificationcode, and the malfunction classification code enables identification ofthe category of the malfunction uniquely. The correspondence between thecategory of malfunction and the malfunction classification code isbeforehand specified uniformly in each of the ECUs 11 to 14.

Subsequently, at step 280, the simultaneous storing request isgenerated. As shown in FIG. 8, a simultaneous storing request 25includes a system identification code 26 generated at immediatelypreceding step 270 and a malfunction classification code 27.

At subsequent step 290, the simultaneous storing request 25 generated atimmediately preceding step 280 is transmitted to the master ECU 11through the in-vehicle LAN 15 (32 c-2 in FIG. 7). The master ECU 11receives the simultaneous storing request 25 (32 a).

Subsequently, at step 145 in FIG. 3, the master ECU 11 determines thatthe simultaneous storing request 25 is received, and the processingproceeds to step 155. At step 155, similarly to step 150, it isdetermined whether the measured time of the timer reaches thepredetermined reference time such as 1000 milliseconds. On determinationthat the measured time does not reach the predetermined reference time,step 155 is executed again. On determination that the measured timereaches the predetermined reference time at the time t53, the processingproceeds to step 165.

The processings at steps 165, 175, 185 are equivalent to the processingsat steps 160, 170, 180, respectively. Therefore, at each of steps 165,175, 185, the value of the elapsed time information 21 in the RAM ischanged by the time unit (e.g., 1000 milliseconds) according to theelapse of the time in the cycle order.

At step 194 subsequent to steps 165, 175, 185, the simultaneous storinginstruction is generated. Specifically, the contents of the simultaneousstoring instruction is modified to include the system identificationcode 26 in the simultaneous storing request 25 determined to be receivedat immediately preceding step 145 and the malfunction classificationcode 27. The system identification code 26 other than the failure valueis employed as the simultaneous storing instruction in this way, andthereby, the simultaneous storing instruction functions as data forstoring the diagnostic information.

At subsequent step 196, the elapsed time information 21 changed by thetime unit according to the elapse of the time in the cycle order valueis generated in the manner as described above. In addition, the vehiclelocal time 20 including the latest value of the validity determinationinformation 22 stored in the retention storage medium is furthergenerated. Furthermore, the vehicle local time 20 and the simultaneousstoring instruction generated at step 196 are included in one dataframe. In addition, the predetermined address ID for broadcasting isincluded in the data frame, so that the data frame, which includes thevehicle local time 20 and the simultaneous storing instruction, are sentto all the ECUs including the slave ECUs 12 to 14, which are other thanthe master ECU 11, connected to the in-vehicle LAN 15. Furthermore, theinterface circuit is caused to send the data frame into the in-vehicleLAN 15 (33 a in FIG. 7).

At subsequent step 198, the diagnostic information is generatedaccording to the simultaneous storing request 25 determined to bereceived at immediately preceding step 145. Further, the diagnosticinformation is associated with the latest vehicle local time 20 storedin the RAM, and the associated information is stored in the retentionstorage medium. The associated information is stored at the time 33 a inFIG. 7.

In the vehicle local time 20 stored with the diagnostic informationpresently, the value of the elapsed time information 21 corresponds tothe elapsed time d4 in FIG. 7, and the value of the validitydetermination information 22 is 00. The diagnostic information of theself device stored presently includes the DTC and the FFD. It is notedthat, the DTC is a value same as the malfunction classification code 27included in the simultaneous storing request 25 determined to bereceived at immediately preceding step 145. The contents of the FFDincluded in the diagnostic information are determined according to thesystem identification code 26 in the simultaneous storing request 25.The correspondence between the system identification code 26 and thecontents of FFD is specified beforehand.

It is noted that, when the master ECU 11 is for the power train system,the master ECU 11 may store the diagnostic information in the retentionstorage medium at step 198, since the system identification code is thepower train system. Alternatively, when the master ECU 11 is not for thepower train system, the master ECU 11 may not store the diagnosticinformation in the retention storage medium at step 198, since thesystem identification code is the power train system.

In this way, each of the slave ECUs 12 to 14 receives the data frame (33b to 33 d in FIG. 7) transmitted from the master ECU 11 (33 a) at step210 in FIG. 4 through the communication interface unit. At subsequentstep 220, each of the slave ECUs 12 to 14 stores, as the latest vehiclelocal time 20, the vehicle local time 20 in the data frame in the RAM ofthe slave ECU thereby to update the vehicle local time 20.

Furthermore, at step 230, the storing event is determined to occur, ondetermination that the simultaneous storing instruction in the dataframe received at immediately preceding step 210 is not the failurevalue. Thus, the processing proceeds to step 240.

In this case, the diagnostic information is generated at step 240.Further, the diagnostic information is associated with the latestvehicle local time 20 stored in the RAM, and the associated informationis stored in the retention storage medium. In the vehicle local time 20stored with the diagnostic information presently, the value of theelapsed time information 21 corresponds to the elapsed time d4 in FIG.7, and the value of the validity determination information 22 is 00.

The diagnostic information stored presently includes the DTC and theFFD. It is noted that, the DTC is a value same as the malfunctionclassification code 27 included in the simultaneous storing instructionreceived at immediately preceding step 210. The contents of the FFDincluded in the diagnostic information are determined according to thesystem identification code 26 in the simultaneous storing request 25.The correspondence between the system identification code 26 and thecontents of FFD is specified beforehand.

It is noted that, the FFD in the diagnostic information stored at thetime t52 by the slave ECU 13, which is the sender of the simultaneousstoring request, may be the same as or may be distinct from the FFD inthe diagnostic information stored by the slave ECU 13 presently.

It is determined whether to store the diagnostic information at step 240according to the system identification code 26 included in thesimultaneous storing instruction received at immediately preceding step210. Specifically, in each of the slave ECUs 12 to 14, it is prescribedthat the system identification code 26 belonging to a specific categoryand included in the simultaneous storing instruction causes the storingof the diagnostic information at step 240 when being received and thesystem identification code 26 belonging to the other category andincluded in the simultaneous storing instruction does not cause thestoring of the diagnostic information at step 240 when being received.

More specifically, the slave ECUs 12 and 13 for controlling the powertrain system store the diagnostic information at step 240, only whenreceiving the simultaneous storing instruction including the systemidentification code at a value representing the power train system orwhen receiving the simultaneous storing instruction including the systemidentification code at a value representing all the ECUs. Alternatively,the slave ECUs 12 and 13 for controlling the power train system do notstore the diagnostic information at step 240 when receiving thesimultaneous storing instruction including the system identificationcode at a value other than the value representing the power train systemor all the ECUs.

More specifically, the slave ECU 14 for controlling the convenience andcomfortable control device system stores the diagnostic information atstep 240, only when receiving the simultaneous storing instructionincluding the system identification code at a value representing theconvenience and comfortable control device system or when receiving thesimultaneous storing instruction including the system identificationcode at a value representing all the ECUs. Alternatively, the slave ECU14 for controlling the convenience and comfortable control device systemdoes not store the diagnostic information at step 240 when receiving thesimultaneous storing instruction including the system identificationcode at a value other than the value representing the convenience andcomfortable control device system or all the ECUs.

In present example, the simultaneous storing request received by theslave ECUs 12 to 14 includes the system identification code at the valuerepresenting the power train system. Therefore, the slave ECUs 12 and 13store the diagnostic information (34 b, 34 c in FIG. 7) at step 240, andthe slave ECU 14 does not store the diagnostic information at step 240.

As follows, the processing of each of the slave ECUs 12 to 14 at step240 will be described further in detail. The processing proceeds to step240 on determination that the storing event occurs at step 230 onreception of the simultaneous storing instruction, which is not at thefailure value. In this case, at step 240, each of the slave ECUs 12 to14 implements the processing shown in FIG. 9.

Specifically, at step 240 a, the system identification code included inthe simultaneous storing instruction is first compared with a codeincluded in a belonging group list stored in the self device. Thus, itis determined whether any one of the codes included in the belonginggroup list is the same as the system identification code. Ondetermination that the any one of the codes included in the belonginggroup list is the same as the system identification code, the processingproceeds to step 240 b, at which the diagnostic information and thelatest vehicle local time 20 are stored in the retention storage medium.Alternatively, on determination that none of the codes included in thebelonging group list is the same as the system identification code beingreceived, the processing skips step 240 b to proceed to step 250. Thus,the processing at step 240 is terminated.

As follows, the belonging group list will be described. In each of theslave ECUs 12, 13, 14, the belonging group list of the self device isbeforehand stored in the retention storage medium or ROM of the selfdevice. The belonging group list stored in each of the slave ECUs 12,13, 14 includes the system identification code corresponding to thegroup to which the slave ECU belongs. The “group” denotes a groupconfigured with the ECUs as components. Therefore, the ECU(s) forcontrolling a device of the body system belongs to a group of the bodysystem, the ECU(s) for controlling the power train belongs to a group ofthe power train system, and the ECU(s) for controlling wirelesscommunication belongs to a group for a wireless system. Furthermore, theECU(s) for controlling illumination of the vehicle belongs to a group ofan illuminations system, and the ECU(s) for controlling the electricpower source of the vehicle belongs to a group of an electric powercontrol system.

In the example shown in FIG. 10, the belonging group list 40 includes,for example, a system identification code corresponding to the group ofthe wireless system, a system identification code corresponding to thegroup of the illumination system, and a system identification codecorresponding to the group of an electric power control system. With thepresent configuration, it is recognized that the slave ECU storing thebelonging group list belongs to the group of the wireless system, thegroup of the illumination system, and the group of the electric powercontrol system.

In this way, each of the slave ECUs 12 to 14 stores the diagnosticinformation on the self device when the system identification codeincluded in the storing instruction sent from the master ECU 11corresponds to the group to which the self device belongs.Alternatively, each of the slave ECUs 12 to 14 does not store thediagnostic information on the self device when the system identificationcode included in the storing instruction sent from the master ECU 11does not correspond to the group to which the self device belongs. Withthe present configuration, information useful for analysis of themalfunction can be selectively stored, thereby to restrain a resourcefor storing the diagnostic information.

As described above, the contents of the FFD including the diagnosticinformation stored at step 240 b are determined according to the systemidentification code 26 in the simultaneous storing request 25. Inaddition, the correspondence between the system identification code 26and the contents of the FFD is specified beforehand.

Specifically, the retention storage medium or the ROM of each of theslave ECUs 12, 13, 14 includes the above-described belonging group listand stores the stored data correspondence table.

The stored data correspondence table stored in each of the slave ECUs12, 13, 14 includes the system identification codes, which are includedin the belonging group list stored in the same slave ECU, each beingassociated correspondingly with an input-and-output data name. Each ofthe input-and-output data in a certain ECU is data in the certain ECUretrieved from a sensor or another ECU, data in the certain ECUoutputted to control an actuator, or data transmitted to the certainECU.

FIG. 11 shows an example of the belonging group list. In the example, itis assumed that the belonging group list included in a certain slaveECU, which may be any one of the slave ECUs 12, 13, 14, includes asystem identification code 01, a system identification code 03, and asystem identification code 05. The system identification code 01corresponds to the group of the wireless system. The systemidentification code 03 corresponds to the group of the illuminationsystem. The system identification code 05 corresponds to the group ofthe electric power control system. In this case, the stored datacorrespondence table includes information on names of thewireless-related input-and-output data corresponding to the systemidentification code 01, names of the illumination-relatedinput-and-output data corresponding to the system identification code03, and names of the power-control-system-related input-and-output datacorresponding to the system identification code 05. The names of thewireless-related input-and-output data corresponding to the systemidentification code 01 include, for example, the classification of amanual operation button of a wireless key device, the state of a doorlock position SW, the state of a door courtesy SW, and/or the like. Thenames of the illumination-related input-and-output data corresponding tothe system identification code 03 include, for example, the state of anillumination SW, an illumination lighting time, an illumination lightinginstruction request from each ECU, and/or the like. The names of thepower-control-system-related input-and-output data corresponding to thesystem identification code 05 include, for example, the state of anignition switch (IGSW), the state of an airconditioner switch (ACCSW),the state of a brake SW, and/or the like.

At step 240 b, each of the slave ECUs 12 to 14 reads theinput-and-output data name, which is associated with the systemidentification code in the simultaneous storing request being received,from the stored data correspondence table of the self device. Inaddition, each of the slave ECUs 12 to 14 sets the data of the readoutinput-and-output data name as the FFD. Further, each of the slave ECUs12 to 14 associates the diagnostic information and an operation historyincluding the FFD and DTC with the latest vehicle, local time 20 andstore the associated information.

In the example shown in FIG. 11, in the case where, for example, thesystem identification code 01 of the wireless system is included in thesimultaneous storing request being received, the data of thewireless-related input-and-output data name is stored as the FFD in thestorage medium, with reference to the stored data correspondence table.

In this way, the slave ECUs 12 to 14 selectively stores in the storagemedium only the input-and-output data in the group corresponding to thesystem identification code, among all the input-and-output data sentfrom and received by the self device. At step 240 b, the latest vehiclelocal time 20 is certainly stored with the diagnostic information,irrespectively of the system identification code in the simultaneousstoring request being received.

With the present configuration, when the slave ECU 12 of the self devicebelongs to the group relevant to an malfunction occurring in a certainslave ECU, the diagnostic information is stored by the self device.Alternatively, when the slave ECU of the self device does not belong tothe group, the diagnostic information is not stored by the self device.Therefore, information useful for analysis of the malfunction can beselectively stored, and the resource for storing the diagnosticinformation can be restrained.

At step 250 subsequent to step 240, the malfunction is not detected inthe self device. Therefore, it is determined that transmission of thesimultaneous storing request is not needed, and the processing returnsto step 210.

Subsequently, at the time t54, with the above-described fundamentaloperation of the master ECU 11 and the slave ECUs 12 to 14, the masterECU 11 implements the vehicle local time generation and the transmissionprocessing in FIG. 3 and transmits the vehicle local time 20 (35 a).Further, the slave ECUs 12 to 14 implements the processing at step 210in FIG. 4 and receives the vehicle local time 20 (35 b to 35 d).

Subsequent to the time t5, the master ECU 11 and the slave ECUs 12 to 14implement the above-described fundamental operation. Thus, the elapsedtime information 21 increases with the elapse of the time, while thevalidity determination information 22 is constant in the ECUs 11 to 14.

Herein, subsequent to the time t5, it is assumed that the vehicle iscarried into, for example, a repair shop, before the elapsed timeinformation 21 becomes the maximum value. In most cases, the IG deviceof the vehicle is once turned OFF and turned ON in the time period afterthe diagnostic information is stored at the time t5 before the vehicleis carried into the repair shop. Nevertheless, as described above, thechange in the value of the elapsed time information 21 is continued bythe time unit according to the elapse of the time, even after the IGdevice is turned ON and OFF.

Subsequently, it is assumed that, at the time t6 in the state where theIG is turned ON, the diagnostic tool 2 is connected to the vehicularsystem 1 through the in-vehicle LAN 15 in, for example, the repair shop.Furthermore, it is assumed that a user of the diagnostic tool 2implements a predetermined operation on an operation device for readingthe diagnostic information on a specific slave ECU. In the presentexample, the specific slave ECU is, for example, the slave ECU 13. Thediagnostic tool 2 may implement either wired communications or wirelesscommunications with the vehicular system 1. Thus, the diagnostic tool 2causes the interface circuit to transmit a readout command to the masterECU 11 and the slave ECUs 12 and 13 through the in-vehicle LAN 15.

On receiving the readout command through the interface circuit of theself device, each of the master ECU 11 and the slave ECUs 12 and 13reads the latest vehicle local time 20, which is stored in the RAM ofthe control circuit of the self device, and the vehicle local time 20,which is associated with the diagnostic information and stored in theretention storage medium of the self device. Further, each of the masterECU 11 and the slave ECUs 12 and 13 causes the interface circuit of theself device to transmit the latest vehicle local time 20, the diagnosticinformation, and the vehicle local time 20 (storing-time vehicle localtime 20), which is associated with the diagnostic information, to thediagnostic tool 2 through the in-vehicle LAN 15.

The diagnostic tool 2 receives the data transmitted from the master ECU11 and the slave ECUs 12 and 13 through the interface circuit of theself device in this way. The diagnostic tool 2 further determineswhether the value of the validity determination information 22 in thelatest vehicle local time 20 is the same as the value of the validitydetermination information 22 in the storing-time vehicle local time 20.On determination that the values of the validity determinationinformation 22 are the same, the diagnostic tool 2 calculates aretroactive time, which is equivalent to the difference between thevalue of the elapsed time information 21 in the latest vehicle localtime 20 and the value of the elapsed time information 21 in thestoring-time vehicle local time 20 (see FIG. 5).

For example, it is assumed a case where the value of the elapsed timeinformation 21 in the latest vehicle local time 20 is 2FFFF in thehexadecimal number notation, and the value of the elapsed timeinformation 21 in the storing-time vehicle local time 20 is 2AFFF in thehexadecimal number notation. In this case, the retroactive timecorresponding to the difference therebetween is 20480 seconds (about 5hours and a half).

In addition, the present absolute time is retrieved from the timecounter device, and an absolute time, at which the diagnosticinformation was stored, is calculated by subtracting the retroactivetime from the retrieved present absolute time. Thus, the display deviceis caused to indicate the calculated absolute time at which thediagnostic information was stored. In this case, the display device isalso caused to indicate the diagnostic information.

When the value of the validity determination information 22 in thelatest vehicle local time 20 is not the same as the value of thevalidity determination information 22 in the storing-time vehicle localtime 20, the absolute time, at which the diagnostic information wasstored, is unclear. Therefore, in such a case, the diagnostic tool 2causes the display device to indicate the storing-time vehicle localtime 20, as it is. In this case, the display device is also caused toindicate the diagnostic information.

As described above, the master ECU 11 changes the value of the elapsedtime information 21, which is included in the vehicle local time 20 tobe transmitted to the slave ECUs 12 to 14, by the time unit according tothe elapse of the time. In addition, the master ECU 11 continues thechange in the value of the elapsed time information 21 by the time unitaccording to the elapse of the time, even when the main power source (IGswitch) of the vehicle is turned ON or turned OFF.

Realistically, a case is conceivable where a user turns the IG deviceOFF and ON, after the diagnostic information and the elapsed time wasstored in the slave ECUs 12 to 14, before the vehicle is actuallycarried into the repair shop, for example, and diagnosed with thediagnostic tool. Even in such a case, the present configuration enablesto reduce possibility of occurrence of a situation where the absolutetime, at which the malfunction has occurred, is unclear, since theelapsed time has been reset due to the turning ON and OFF of the IGdevice. That is, the absolute time, at which the event occurs, can bespecified with higher possibility than that of a conventionalconfiguration.

Realistically, a user of the vehicle may inquire about a trouble causedat a specific time (e.g., about 17:30, January 13). In such a case, thepresent configuration enables to retrieve the absolute time, at whichthe diagnostic information related to the trouble was stored, togetherwith the diagnostic information by using the diagnostic tool 2.Therefore, the cause of the trouble can be easily and appropriatelyspecified in response to such an inquiry of the user.

It is noted that, when the master ECU 11 returns from the reset state,it is unclear the time period, in which the master ECU 11 had been outof operation. Therefore, the recent value of the elapsed timeinformation 21, when the master ECU 11 was previously in operation, doesnot represent appropriate progress in time. In consideration of this,the elapsed time information is set to the minimum immediately after thereturn from the reset state. In addition, in response to the return fromthe reset state, the master ECU 11 newly stores the elapsed timeinformation 21 at its initial value in the volatile storage medium.Thereby, the elapsed time information 21 is enabled to represent thecorrect elapsed time from the time point of the return from the resetstate.

Furthermore, the master ECU 11 stores a valid value of the validitydetermination information 22 in the retention storage medium, separatelyfrom the elapsed time information 21. The retention storage mediumretains the stored content even when the master ECU 11 is reset. Inaddition, the master ECU 11 changes the valid value of the validitydetermination information 22 stored in retention storage medium (e.g.,volatile storage medium) in response to return of the master ECU 11 fromthe reset state. Furthermore, the master ECU 11 generates the vehiclelocal time 20 including the validity determination information 22 inaddition to the elapsed time information 21 and repeatedly transmits thevehicle local time 20 to the slave ECUs 12 to 14.

With the present configuration, the valid value of the validitydetermination information 22, the elapsed time information 21, and thediagnostic information are stored in the storage medium in the slaveECUs 12 to 14. Therefore, the diagnostic information, which is storedbefore the return of the master ECU 11 from the reset state, isdistinguishable from the diagnostic information, which is storedsubsequent to the return of the master ECU 11 from the reset state.

In the vehicle local time generation and transmission processing in FIG.3 implemented by the master ECU 11, the processing proceeds to step 105on determination that the readout is unsuccessful at step 103. At step105, the vehicle local time 20 is set at the predetermined failurevalue. For example, the predetermined failure value represents thevehicle local time 20 being at the maximum value (03h) and the elapsedtime information 21 being at the maximum value (3FFFFEh). At step 110subsequent to step 105, the vehicle local time 20 at the failure valueis transmitted to the slave ECUs 12 to 14 (110, 115) repeatedly at aconstant cycle, such as 1000 ms.

As described above, in the vehicular system 1 of the present disclosure,the slave ECU 13 (or other slave ECUs 12 and 14) transmits thesimultaneous storing request to the master ECU 11, on detection of amalfunction. The master ECU 11 transmits the simultaneous storinginstruction for causing the diagnostic information to be stored, onreception of the simultaneous storing request. The slave ECUs 12 and 13generates the diagnostic information on the self device and stores thegenerated diagnostic information in the retention storage medium, onreception of the simultaneous storing instruction transmitted from themaster ECU 11.

With the present configuration, even when the slave ECU 13 detects amalfunction, the diagnostic information is generated and stored in theECUs, such as the master ECU 11 and the slave ECU 12, other than theslave ECU 13.

In addition, the slave ECU 13 includes the malfunction classificationcode, which represents the classification of the malfunction, in thesimultaneous storing request to be transmitted to the master ECU 11. Themaster ECU 11 includes the malfunction classification code, which isincluded in the simultaneous storing request received from the slave ECU13, in the simultaneous storing instruction to be transmitted. The slaveECUs 12 and 13 include the malfunction classification code, which isincluded in the simultaneous storing instruction received from themaster ECU 11, in the diagnostic information on the self device.

The present configuration enables easily to specify the classificationof the malfunction, which is detected by the other ECU 13, causing theslave ECU 12 to store the diagnostic information.

In addition, the slave ECU 13 includes the predetermined systemidentification code in the simultaneous storing request to betransmitted to the master ECU 11. The master ECU 11 includes the systemidentification code, which is included in the simultaneous storingrequest received from the slave ECU 13, in the simultaneous storinginstruction to be transmitted. The slave ECUs 12, 13, 14 determineswhether to store the diagnostic information in the slave ECU 12,according to the system identification code included in the simultaneousstoring instruction received from the master ECU 11.

With the present configuration, the slave ECU 13 is enabled to controlwhether to cause the other slave ECUs 12 and 13 to generate and storethe diagnostic information by using the system identification code.

It is conceivable that the master ECU 11 changes the value of theelapsed time information 21 by the time unit according to the elapse ofthe time. In this case, the master ECU 11 generates the vehicle localtime 20 including the elapsed time information 21 and transmits thegenerated vehicle local time 20 with the simultaneous storinginstruction to the slave ECU 12. In this case, on reception of thevehicle local time 20 and the simultaneous storing instruction from themaster ECU 11, the slave ECU 12 associates the diagnostic information onthe slave ECU 12 with the vehicle local time 20 to each other and storesthe associated diagnostic information and the vehicle local time 20 inthe retention storage medium. In this case, on reception of the vehiclelocal time 20 and the storing instruction from the master ECU 11, theslave ECU 14 associates the diagnostic information on the slave ECU 14with the vehicle local time 20 to each other and store the associateddiagnostic information and the vehicle local time 20 in the retentionstorage medium.

With the present configuration, when storing the diagnostic information,the slave ECU 12 and the slave ECU 14 store the vehicle local time 20provided from the master ECU 11 all together. Therefore, the time usedas the storing time of the diagnostic information can be manageduniformly in the master ECU 11.

In addition, for each of the slave ECUs 12 to 14, the simultaneousstoring request is transmitted together with the in-vehicle local timeat the transmission timing of the in-vehicle local time 20. Therefore,the vehicle local time stored with the diagnostic information isdetermined clearly on the side of the slave ECUs. Suppose a differentconfiguration, in which the simultaneous storing request and thein-vehicle local time are received at separate timings, respectively. Insuch a configuration, it is necessary to determine whether to employ thein-vehicle local time, which is received immediately before reception ofthe simultaneous storing request or whether to employ the in-vehiclelocal time, which is received immediately after reception of thesimultaneous storing request, as the vehicle local time stored withdiagnostic information.

In a case where, for example, ten of the simultaneous storing requestsare continually transmitted, the timing of the processing may bedelayed. In such a case, the time elapses after receiving a large numberof the simultaneous storing requests until the simultaneous storingrequests are processed, and meanwhile, the vehicle local time proceedsin the slave ECU. Consequently, the time, at which the simultaneousstoring requests were received, becomes inaccurate. Contrary, thepresent configuration enables to store the vehicle local time togetherwith the simultaneous storing request thereby to avoid causinginaccurate time record.

Other Embodiment

As described above, although the embodiment has been described, thescope of the present disclosure is not limited to the embodiment. Thescope of the present disclosure includes various forms, which canproduce a function of each subject matter of the present disclosure. Forexample, the following forms are also included in the presentdisclosure.

(1) In the above-described embodiment, the simultaneous storing requestis transmitted from the slave ECUs 12 to 14 to the master ECU 11. It isnoted that, the simultaneous storing request may be transmitted from anECU, other than the slave ECUs 12 to 14 in the vehicular system 1, tothe master ECU 11.

For example, as shown in FIG. 12, the vehicular system 1 may furtherinclude slave ECUs 15 to 18, in addition to the ECUs 11 to 14. The slaveECUs 15 to 18 are connected to the in-vehicle LAN 15 and may beconfigured to transmit the simultaneous storing request to the masterECU 11, on occurrence of an anomaly such as a malfunction of the selfdevice. The slave ECUs 15 to 18 may include the same functions as theabove-described functions of the slave ECUs 12 to 14.

Furthermore, in the above-described embodiment, the simultaneous storingrequest is transmitted at the time t51, on detection of a malfunction ofthe slave ECU 13. It is noted that, any of the slave ECUs 12, 14 to 18may transmit the simultaneous storing request at another time point ondetection of an anomaly such as a malfunction of the self device. Inthis case, the operation of the slave ECU on detection of a malfunctionmay be the same as the operation of the slave ECU 13 subsequent to thetime t51.

As described above, any of the slave ECUs 12 to 18 has adetected-anomaly-on-self-device storing function to store the diagnosticinformation in the retention storage medium of the self device ondetection of an anomaly such as a malfunction in the self device. Thedetected-anomaly-on-self-device storing function may be equivalent tothe processing at step 240 subsequent to step 230 on detection of ananomaly such as a malfunction in the self device. Any of the slave ECUs12 to 18 further has a simultaneous-storing-request transmittingfunction to select the simultaneous storing request including the systemidentification code corresponding to the anomaly, on detection of ananomaly such as a malfunction in the self device, and to transmit theselected simultaneous storing request to the master ECU 11. Thesimultaneous-storing-request transmitting function may be equivalent tothe processing at steps 250 to 290. Any of the slave ECUs 12 to 18further has an instruction-correspondence storing function to store thediagnostic information including the input-and-output data correspondingto the system identification code in the retention storage medium of theself device, on reception of the simultaneous storing request from themaster ECU 11, when the belonging group list of the self device includesthe system identification code included in the simultaneous storingrequest. The instruction-correspondence storing function is also not tostore the diagnostic information in the retention storage medium of theself device when the belonging group list of the self device does notinclude the system identification code included in the simultaneousstoring request. The instruction correspondence storing function may beequivalent to the processing at steps 240 a and 240 b. With the presentconfiguration, even when any of the slave ECUs detects an anomaly, thedata related to the anomaly can be stored in another slave ECU.

With the present configuration, each of the slave ECUs 12 to 18transmits, on detection of an anomaly in the self device in a certaincase, the simultaneous storing request including the systemidentification code (one example of a first system identification code)corresponding to the anomaly to the master ECU 11 (one example of astoring instruction transmitting device). In response to this, themaster ECU 11 is caused to transmit the simultaneous storing instruction(one example of a first storing instruction) including the systemidentification code. The simultaneous storing request is one example ofa first storing request.

In another case, it is assumed that the master ECU 11 transmits thesimultaneous storing instruction (one example of a second storinginstruction), on reception of another simultaneous storing request (oneexample of a second storing request) than the above-describedsimultaneous storing request, from another slave ECU, such as the slaveECU 12, (one example of another device) other than the slave ECU, suchas the slave ECU 15. In this case, the master ECU 11 determines, onreception of the simultaneous storing instruction, and according to thesystem identification code (one example of a second systemidentification code) included in the received simultaneous storinginstruction, whether to store the diagnostic information in the slaveECU. On determination to store the diagnostic information, the masterECU 11 stores the diagnostic information including the datacorresponding to the system identification code in the storage medium ofthe self device.

The present configuration enables each of the slave ECUs 12 to 18 tostore the diagnostic information in another device according to theanomaly detected in the self device. In addition, when an anomaly isdetected in another device, the diagnostic information can be stored inthe self device.

Similarly to the slave ECUs 12 to 18, the master ECU 11 may store thebelonging group list and the stored data correspondence table of theself device. In this case, the master ECU 11 may implement theprocessings in FIG. 4, FIG. 5, FIG. 9, in addition to the processingsdescribed in the above embodiment. In this case, it is noted that thesubject generated at step 280 is a simultaneous storing command insteadof the simultaneous storing request. In addition, the subjecttransmitted at step 290 is the simultaneous storing command instead ofthe simultaneous storing request, and the simultaneous storing commandis sent to all the ECUs connected to the in-vehicle LAN 15. Similarly tothe slave ECUs 12 to 18, the master ECU 11 may store the belonging grouplist and the stored data correspondence table of the self device. Inthis case, at step 198, the master ECU 11 may implement the processingsof step 240 a, 240 b in FIG. 9.

With the present configuration, the master ECU 11 has adetected-anomaly-on-self-device storing function to store the diagnosticinformation in the retention storage medium of the self device ondetection of an anomaly such as a malfunction in the self device. Thedetected-anomaly-on-self-device storing function may be equivalent tothe processing at step 240 subsequent to step 230 on detection of ananomaly such as a malfunction in the self device. In this case, themaster ECU 11 further has a simultaneous-storing-instructiontransmitting function to select the simultaneous storing instructionincluding the system identification code corresponding to the anomaly,on detection of an anomaly such as a malfunction in the self device, andto transmit the selected simultaneous storing instruction to all theECUs 11 to 18. The simultaneous-storing-instruction transmittingfunction may be equivalent to the processing at step 196. In this case,the master ECU 11 further has an instruction-correspondence storingfunction to store the diagnostic information including theinput-and-output data corresponding to the system identification code inthe retention storage medium of the self device, on reception of thesimultaneous storing instruction from the master ECU 11 (self device)through the in-vehicle LAN 15, when the belonging group list of the selfdevice includes the system identification code included in thesimultaneous storing instruction. The instruction-correspondence storingfunction is also not to store the diagnostic information in theretention storage medium of the self device when the belonging grouplist of the self device does not include the system identification codeincluded in the simultaneous storing instruction. The instructioncorrespondence storing function may be equivalent to the processing atsteps 198, 240 a, 240 b.

As follows, the belonging state of the slave ECUs 12 to 18 to the groupsexemplified in FIG. 12 will be described. The slave ECUs 12, 13, 15belong to the group of the wireless system. The slave ECUs 12, 13, 15,16 belong to the group of the electric power control system. The slaveECUs 13 and 14 belong to the group of the illumination system. The slaveECUs 14, 17, 18 belong to the group of a lamplight system. The slaveECUs 15, 16, 18 belong to the group of the power train system. Asexemplified here, one ECU may belong to multiple groups.

In an alternative configuration, a user of the diagnostic tool 2 may beenabled to implement a predetermined operation on the operation unit ofthe diagnostic tool 2 connected to the in-vehicle LAN 15 thereby tocause the diagnostic tool 2 to transmit the simultaneous storing requestto the master ECU 11 through the in-vehicle LAN 15. In this case, thecontents of the system identification code included in the simultaneousstoring request and the malfunction classification code may be specifiedbeforehand. Alternatively, a user of the diagnostic tool 2 may beenabled to set the contents with the operation unit.

In another alternative configuration, the wireless communication devicemay be connected to the in-vehicle LAN 15, and a center outside thevehicle may implement wireless communications with the wirelesscommunication device. In this case, the simultaneous storing request maybe transmitted to the master ECU 11 through the wireless communicationdevice and the in-vehicle LAN 15. In this case, the contents of thesystem identification code included in the simultaneous storing requestand the malfunction classification code may be specified beforehand.Alternatively, the center may be enabled to set the contents with theoperation unit.

Specifically, a storing request transmission device, which is configuredto transmit the simultaneous storing request to the master ECU 11, maybe equipped to the vehicle. Alternatively, the storing requesttransmission device may be a communication device, such as thediagnostic tool 2, connectable with the in-vehicle LAN 15 as needed.Alternatively, the storing request transmission device may be acommunication device, such as the center, located outside the vehicleand configured to implement wireless communications with the master ECU11.

In the configuration where the communication device outside the vehicletransmits the simultaneous storing request to the master ECU 11, themaster ECU 11 implements the same operation as the operation in the casewhen receiving the simultaneous storing request from the slave ECUs 12to 14. It is noted that, a configuration may be employed to transmitdata, which represents a vehicle local time error, to the sender of thesimultaneous storing request, when the vehicle local time does notchange normally in the master ECU 11. In this way, the communicationdevice outside the vehicle is enabled to detect an anomaly of thevehicle local time.

(2) In an alternative configuration, a user of the diagnostic tool 2 maybe enabled to implement a predetermined operation on the operation unitof the diagnostic tool 2 connected to the in-vehicle LAN 15 thereby tocause the diagnostic tool 2 to transmit the simultaneous storinginstruction through the in-vehicle LAN 15 to all the ECUs, which includethe ECUs 11 to 14 connected to the in-vehicle LAN 15.

In another alternative configuration, the wireless communication devicemay be connected to the in-vehicle LAN 15, and a center outside thevehicle may implement wireless communications with the wirelesscommunication device. In this case, the simultaneous storing request maybe transmitted through the wireless communication device and thein-vehicle LAN 15 to all the ECUs, which include the ECUs 11 to 14connected to the in-vehicle LAN 15.

Specifically, a storing request transmission device, which is configuredto transmit the storing request to the master ECU 11, may be equipped tothe vehicle. Alternatively, the storing request transmission device maybe a communication device connectable with the in-vehicle LAN 15 asneeded. Alternatively, the storing request transmission device may be acommunication device located outside the vehicle and configured toimplement wireless communications with the master ECU 11.

A storing instruction transmission device, which is configured totransmit the storing instruction to the vehicular ECU including the ECUs11 to 14 may be the master ECU 11 equipped to the vehicle.Alternatively, the storing instruction transmission device may be acommunication device connectable with the in-vehicle LAN 15 as needed.Alternatively, the storing instruction transmission device may be acommunication device located outside the vehicle and configured toimplement wireless communications with the master ECU 11.

(3) In the above-described embodiment, the slave ECUs 12 to 14 transmitthe simultaneous storing request to the master ECU 11 on detection of amalfunction. In addition, the master ECU 11 transmits the simultaneousstoring instruction to each of the ECUs 12 to 14 connected to thein-vehicle LAN 15. That is, the master ECU 11 functions as a repeaterdevice.

It is noted that, the repeater device may be omitted. For example, whenone of the slave ECUs 12 to 14 (one example of a first ECU and a storinginstruction transmission device) detects a malfunction similarly to theabove-described embodiment, the one of the slave ECUs 12 to 14 maytransmit not the simultaneous storing request but the simultaneousstoring instruction to another ECUs, which includes the master ECU andthe other slave ECUs, connected to the vehicular LAN. In this case, onreception of the simultaneous storing instruction, the ECU (one exampleof a second ECU) may store the diagnostic information in the retentionstorage medium according to the contents of the simultaneous storinginstruction, similarly to the slave ECUs 12 to 14 according to the firstembodiment.

(4) In the above embodiment, the master ECU 11 transmits periodicallythe data frame including the simultaneous storing instruction and thevehicle local time 20. It is noted that, on reception of the multiplesimultaneous storing requests from multiple ECUs in the time periodafter transmitting one data frame before transmitting the subsequentdata frame, the master ECU 11 may generate multiple simultaneous storinginstructions corresponding to the multiple simultaneous storing requestsand may transmit the data frame including the multiple simultaneousstoring instructions and the vehicle local time 20 to the slave ECUs 12to 14.

(5) In the above-described embodiment, the it is assumed that themalfunction that the engine revolution exceeds the allowable range isassigned to the system identification code of the power train system.Therefore, at step 270, the slave ECU 13 generates the systemidentification code at the value representing the power train system, atthe time t52. It is noted that, in an alternative configuration, at step270 and at the time t52, the slave ECU 13 may generate not the systemidentification code at the value representing the power train system butthe system identification code at a value representing all the ECUs tothe malfunction that the engine revolution exceeds the allowable range.With the present configuration, both the simultaneous storing requesttransmitted from the slave ECU 13 and the simultaneous storinginstruction transmitted from the master ECU 11 include the systemidentification code at the value representing all the ECUs. Therefore,all the slave ECUs 12 to 14, which receive the simultaneous storinginstruction, store the diagnostic information with the latest vehiclelocal time 20 in the retention storage medium.

(6) In the above-described embodiments, the three ECUs 12 to 14 areexemplified as the slave ECUs. It is noted that, the number of the slaveECU(s) included in the vehicular system 1 may be one or two and may befour or more.

(7) In the above-described embodiment, the value of the elapsed timeinformation 21 is incremented by one count for each 1 second. Itis'noted that, the value of the elapsed time information 21 may beincremented by one count for each another time unit such as 2 seconds,0.5 second, or 10 seconds. The bit length of the elapsed timeinformation 21 is not limited to 22 bits. The bit length of the validitydetermination information 22 is not limited to 2 bits.

(8) In the above-described embodiment, the main body ECU is employed asone example of the master ECU 11. It is noted that, the master ECU 11may be another ECU than the main body ECU. The master ECU 11 may be anECU for exclusive use to transmit the vehicle local time 20.

(9) In the above-described embodiment, the slave ECU 12 and the slaveECU 13 are for controlling the power train system, and the slave ECU 14is for controlling the devices of the body system. It is noted that, thepurpose of the slave ECUs 12 to 14 are not limited to theabove-described example. For example, any one of the slave ECUs 12 to 14may be for another purpose such as for controlling the air-conditioningsystem, the brake system, and or the like, other than or in combinationof the above-described purposes.

(10) In the above embodiment, the diagnostic tool 2 receives thediagnostic information and the vehicle local time 20 associated to eachother from the slave ECU 13. In addition, the diagnostic tool 2 receivesthe latest vehicle local time 20 from the same slave ECU 13. It is notedthat, the combination of the diagnostic tool 2 and the ECU intransmission of the information is not limited to the above-describedexample. The diagnostic tool 2 may receive the latest vehicle local time20 from another ECU such as any of the ECUs 11, 12, 14 in the vehicularsystem than the ECU 13.

(11) In above-described embodiment, in the case where the time counterdevice for measuring the absolute time is included in the vehicularsystem 1, the ECU 11 may retrieve the absolute time from the timecounter device thereby to correct the change rate of the value of theelapsed time information 21. For example, it is assumed a case where theelapsed time information 21 changes by T1+ΔT seconds, although it haselapsed by T1 seconds according to the absolute time retrieved from thetime counter device. In this case, at steps 110 and 150 in FIG. 3, itmay be determined whether it has elapsed by (1000millisecond×T1/(T1+ΔT)) seconds has elapsed, instead of thedetermination whether it has elapsed by 1000 milliseconds.

(12) In the above embodiment, the IG device (ignition system) isexemplified as the main power source of the vehicle. It is noted that,the main power source of the vehicle is not limited to the IG device. Ina case where the vehicle is an electric vehicle, a main electric powersource for supplying electricity to an electric motor for driving thevehicle may be exemplified as the main power source of the vehicle.

(13) In above-described embodiment, each function produced by executionof a program by the CPU of the control circuit in each of the ECUs 11 to14 may be produced by another hardware such as an FPGA, which canprogram a circuit structure having the function.

The above-described vehicular system equipped to the vehicle mayinclude: the master ECU (11); the first slave ECU (12); and the secondslave ECU (13). The second slave ECU (13) may be configured to transmitthe storing request to the master ECU (11), on detection of amalfunction. The master ECU (11) may be configured to transmit thestoring instruction for causing the diagnostic information to be stored,on reception of the storing request. The first slave ECU (12) may beconfigured, on reception of the storing instruction transmitted from themaster ECU (11): to generate the diagnostic information on the firstslave ECU (12); and to store the generated diagnostic information in theretention storage medium, the retention storage medium being configuredto retain the validity determination information in a condition wherethe first slave ECU is not supplied with electric power source.

With the present configuration, the storing request is transmitted fromthe second slave ECU (13) to the master ECU (11). In addition, thestoring instruction is transmitted, on reception of the storing request,from the master ECU (11) to the first slave ECU (12). In addition, thefirst slave ECU (12) stores, on reception of the storing instruction,the diagnostic information on the first slave ECU (12).

With the present configuration, even when the second slave ECU (13)detects a malfunction, diagnostic information is generated and stored inthe ECU (first slave ECU (12)) other than the second slave ECU (13).

The second slave ECU (13) may be further configured to include themalfunction classification code, which represents the classification ofthe malfunction, in the storing request to be transmitted to the masterECU (11). The master ECU (11) may be further configured to include themalfunction classification code, which is included in the storingrequest received from the second slave ECU (13), in the storinginstruction to be transmitted. The first slave ECU (12) may be furtherconfigured to include the malfunction classification code, which isincluded in the storing instruction received from the master ECU (11),in the diagnostic information on the first slave ECU (12).

The present configuration enables easily to specify the classificationof the malfunction, which is detected by another ECU, causing the firstslave ECU (12) to store the diagnostic information.

The second slave ECU (13) may be further configured to include thepredetermined system identification code in the storing request to betransmitted to the master ECU (11). The master ECU (11) may be furtherconfigured to include the system identification code, which is includedin the storing request received from the second slave ECU (13), in thestoring instruction to be transmitted. The first slave ECU (12) may befurther configured to determine whether to store the diagnosticinformation on the first slave ECU (12) according to the systemidentification code included in the storing instruction received fromthe master ECU (11).

With the present configuration, the second slave ECU (13) is enabled tocontrol whether to cause the first slave ECU (12) to generate and storethe diagnostic information by using the system identification code.

The system identification code, which the second slave ECU (13) includesin the storing request, may be the system identification code related tothe detected malfunction. The first slave ECU (12) may be furtherconfigured: to store the diagnostic information on the first slave ECU(12), when the system identification code, which is included in thestoring instruction received from the master ECU (11), is a codecorresponding to a group to which the first slave ECU (12) belongs; andnot to store the diagnostic information on the first slave ECU (12),when the system identification code, which is included in the storinginstruction received from the master ECU (11), is not a codecorresponding to the group to which the first slave ECU (12) belongs.

With the present configuration, when the first slave ECU (12) belongs tothe group related to a malfunction occurring in the second slave ECU(13), the diagnostic information is stored by the first slave ECU (12).Alternatively, when the first slave ECU (12) does not belong to thegroup, the diagnostic information is not stored by the first slave ECU(12). Therefore, information useful for analysis of the malfunction canbe selectively stored, and the resource for storing the diagnosticinformation can be restrained.

The first slave ECU (12) may be further configured: to select dataaccording to the system identification code included in the storinginstruction received from the master ECU (11); and to include theselected data in the diagnostic information and store the diagnosticinformation.

With the present configuration, data related to a malfunction occurringin the second slave ECU (13) can be selectively stored, thereby torestrain a resource for storing the diagnostic information.

The vehicular system may further include a third slave ECU (14). Themaster ECU (11) may be further configured: to change the value of theelapsed time information (21) by a time unit according to the elapse ofthe time; to generate the vehicle local time (20) including the elapsedtime information (21); and to transmit the generated vehicle local time(20) with the storing instruction to the first slave ECU (12). The firstslave ECU (12) may be further configured, on reception of the vehiclelocal time (20) and the storing instruction from the master ECU (11): toassociate the diagnostic information on the first slave ECU (12) withthe vehicle local time (20); and to store the associated diagnosticinformation on the first slave ECU (12) and the vehicle local time (20)in the retention storage medium. The third slave ECU (14) may beconfigured, on reception of the vehicle local time (20) and the storinginstruction from the master ECU (11): to associate the diagnosticinformation on the third slave ECU (14) with the vehicle local time(20); and to store the associated diagnostic information on the thirdslave ECU (14) and the vehicle local time (20) in the retention storagemedium, the retention storage medium being configured to retain thevalidity determination information in a condition where the third slaveECU is not supplied with electric power source.

With the present configuration, when storing the diagnostic information,the first slave ECU (12) and the third slave ECU (14) store the vehiclelocal time (20) provided from the master ECU (11) all together.Therefore, the time used as the storing time of the diagnosticinformation can be managed uniformly in the master ECU (11).

The vehicular system equipped to the vehicle includes the first ECU andthe second ECU. The first ECU may be configured to transmit the storinginstruction for causing diagnostic information to be stored, ondetection of a malfunction. The second ECU may be configured, onreception of the storing instruction transmitted from the first ECU: togenerate diagnostic information on the second ECU; and to store thegenerated diagnostic information on the second ECU in the retentionstorage medium, the retention storage medium being configured to retainthe validity determination information in a condition where the secondECU is not supplied with electric power source.

With the present configuration, the storing instruction is transmittedfrom the first ECU to the second ECU, and the second ECU, which receivesthe storing instruction, stores the diagnostic information on the secondECU. With the present configuration, even when the first ECU detects amalfunction, the diagnostic information is generated and stored in thesecond ECU.

The ECU equipped to the vehicle may be configured, on reception of thestoring instruction from the outside: to generate the diagnosticinformation on the ECU; and to store the generated diagnosticinformation in the retention storage medium, the retention storagemedium being configured to retain the validity determination informationin a condition where the ECU is not supplied with electric power source.

The storing instruction transmission device may be configured totransmit the storing instruction to the vehicular ECU (11 to 14), thevehicular ECU (11 to 14) being configured, on reception of the storinginstruction from the outside: to generate diagnostic information on theself device; and to store the generated diagnostic information in theretention storage medium, the retention storage medium being configuredto retain validity determination information in a condition where theself device is not supplied with electric power source. Thus, thepresent disclosure may also encompass the storing instructiontransmission device configured to transmit the storing instruction tothe vehicular ECU (11 to 14).

The storing instruction transmission device is equipped to the vehicleand may be configured, on reception of the storing request from theoutside, to transmit the storing instruction to the vehicular ECU (11 to14).

The present disclosure may further encompass the storing requesttransmission device configured to transmit the storing request to thestoring instruction transmission device.

The ECU communicable with the storing instruction transmission device(11) may include the storing request transmission unit configured, ondetection of an anomaly by the self device, to transmit the firststoring request, which includes the first system identification codecorresponding to the anomaly, to the storing instruction transmissiondevice (11) thereby to cause the storing instruction transmission device(11) to transmit the first storing instruction, which includes the firstsystem identification code.

The ECU may further include the instruction correspondence storing unitconfigured to receive the second storing instruction, when the storinginstruction transmission device (11) transmits the second storinginstruction on reception of the second storing request from a deviceother than the ECU; to determine whether to store the diagnosticinformation on the ECU, according to the second system identificationcode included in the received second storing instruction; and to storethe diagnostic information, which includes data corresponding to thesecond system identification code, in the storage medium of the selfdevice, on determination to store.

The present configuration enables one ECU to store the diagnosticinformation in another device according to the anomaly detected in theself device. In addition, when an anomaly is detected in another device,the diagnostic information can be stored in the self device.

The above-described numeral in the parentheses does not limit therelationship between the numeral and the related element in thedisclosure.

The above structures of the embodiments can be combined as appropriate.The above processings such as calculations and determinations may beperformed by any one or any combinations of software, an electriccircuit, and the like. The software may be stored in a non-transitorycomputer readable medium, and may be transmitted via a transmissiondevice such as a network device. The electric circuit may be anintegrated circuit, and may be a discrete circuit. The elementsproducing the above processings may be discrete elements and may bepartially or entirely integrated.

It should be appreciated that while the processes of the embodiments ofthe present disclosure have been described herein as including aspecific sequence of steps, further alternative embodiments includingvarious other sequences of these steps and/or additional steps notdisclosed herein are intended to be within the steps of the presentdisclosure.

While the present disclosure has been described with reference topreferred embodiments thereof, it is to be understood that thedisclosure is not limited to the preferred embodiments andconstructions. The present disclosure is intended to cover variousmodification and equivalent arrangements. In addition, while the variouscombinations and configurations, which are preferred, other combinationsand configurations, including more, less or only a single element, arealso within the spirit and scope of the present disclosure.

1. A vehicular system equipped to a vehicle, the vehicular systemcomprising: a master ECU; a first slave ECU; and a second slave ECU,wherein the second slave ECU is configured to transmit a storing requestto the master ECU on detection of a malfunction, the master ECU isconfigured to transmit a storing instruction on reception of the storingrequest, and the first slave ECU is configured, on reception of thestoring instruction from the master ECU: to generate diagnosticinformation on the first slave ECU; and to store the generateddiagnostic information in a retention storage medium, the retentionstorage medium being configured to retain validity determinationinformation in a condition where the first slave ECU is not suppliedwith electric power.
 2. The vehicular system according to claim 1,wherein the second slave ECU is further configured to include amalfunction classification code, which represents a classification ofthe malfunction, in the storing request to be transmitted to the masterECU, the master ECU is further configured to include the malfunctionclassification code, which is included in the storing request receivedfrom the second slave ECU, in the storing instruction to be transmitted,and the first slave ECU is further configured to include the malfunctionclassification code, which is included in the storing instructionreceived from the master ECU, in the diagnostic information on the firstslave ECU.
 3. The vehicular system according to claim 1, wherein thesecond slave ECU is further configured to include a predetermined systemidentification code in the storing request to be transmitted to themaster ECU, the master ECU is further configured to include the systemidentification code, which is included in the storing request receivedfrom the second slave ECU, in the storing instruction to be transmitted,and the first slave ECU is further configured to determine whether tostore the diagnostic information on the first slave ECU according to thesystem identification code included in the storing instruction receivedfrom the master ECU.
 4. The vehicular system according to claim 3,wherein the system identification code, which the second slave ECUincludes in the storing request, is related to the detected malfunction,the first slave ECU is further configured: to store the diagnosticinformation on the first slave ECU, when the system identification code,which is included in the storing instruction received from the masterECU, corresponds to a group to which the first slave ECU belongs; andnot to store the diagnostic information on the first slave ECU, when thesystem identification code, which is included in the storing instructionreceived from the master ECU, does not correspond to the group to whichthe first slave ECU belongs.
 5. The vehicular system according to claim1, wherein the first slave ECU is further configured: to select dataaccording to the system identification code included in the storinginstruction received from the master ECU; and to include the selecteddata in the diagnostic information and store the diagnostic information.6. The vehicular system according to claim 1, further comprising: athird slave ECU, wherein the master ECU is further configured: to changea value of elapsed time information by a time unit according to elapseof time; to generate a vehicle local time including the elapsed timeinformation; and to transmit the generated vehicle local time with thestoring instruction to the first slave ECU, the first slave ECU isfurther configured, on reception of the vehicle local time and thestoring instruction from the master ECU: to associate the diagnosticinformation on the first slave ECU with the vehicle local time; and tostore the associated diagnostic information on the first slave ECU andthe vehicle local time in the retention storage medium, and the thirdslave ECU is configured, on reception of the vehicle local time and thestoring instruction from the master ECU: to associate the diagnosticinformation on the third slave ECU with the vehicle local time; and tostore the associated diagnostic information on the third slave ECU andthe vehicle local time in a retention storage medium, the retentionstorage medium being configured to retain validity determinationinformation in a condition where the third slave ECU is not suppliedwith electric power.
 7. A vehicular system equipped to a vehicle, thevehicular system comprising: a first ECU; and a second ECU, wherein thefirst ECU is configured to transmit a storing instruction on detectionof a malfunction, and the second ECU is configured, on reception of thestoring instruction transmitted from the first ECU: to generatediagnostic information on the second ECU; and to store the generateddiagnostic information on the second ECU in a retention storage medium,the retention storage medium being configured to retain validitydetermination information in a condition where the second ECU is notsupplied with electric power.
 8. An ECU equipped to a vehicle, the ECUconfigured, on reception of a storing instruction from an outside: togenerate diagnostic information on the ECU; and to store the generateddiagnostic information in a retention storage medium, the retentionstorage medium being configured to retain validity determinationinformation in a condition where the ECU is not supplied with electricpower.
 9. A storing instruction transmission device configured totransmit a storing instruction to a vehicular ECU, the vehicular ECUbeing configured, on reception of the storing instruction from anoutside: to generate diagnostic information on the storing instructiontransmission device; and to store the generated diagnostic informationin a retention storage medium, the retention storage medium beingconfigured to retain validity determination information in a conditionwhere the storing instruction transmission device is not supplied withelectric power.
 10. The storing instruction transmission deviceaccording to claim 9, the storing instruction transmission device beingequipped to a vehicle and configured, on reception of the storingrequest from an outside, to transmit the storing instruction to thevehicular ECU.
 11. A storing request transmission device configured totransmit the storing request to the storing instruction transmissiondevice according to claim
 10. 12. An ECU communicable with a storinginstruction transmission device, the ECU comprising: a storing requesttransmission unit configured, on detection of an anomaly by the ECU, totransmit a first storing request, which includes a first systemidentification code corresponding to the anomaly, to a storinginstruction transmission device thereby to cause the storing instructiontransmission device to transmit a first storing instruction, whichincludes the first system identification code; and an instructioncorrespondence storing unit configured: to receive a second storinginstruction, when the storing instruction transmission device transmitsthe second storing instruction on reception of a second storing requestfrom a device other than the ECU; to determine whether to storediagnostic information on the ECU, according to a second systemidentification code included in the received second storing instruction;and to store diagnostic information, which includes data correspondingto the second system identification code, in a storage medium of theECU, on determination to store.
 13. The vehicular system according toclaim 1, wherein the retention storage medium is a non-volatile storagemedium.
 14. The vehicular system according to claim 7, wherein theretention storage medium is a non-volatile storage medium.
 15. The ECUaccording to claim 8, wherein the retention storage medium is anon-volatile storage medium.
 16. The storing instruction transmissiondevice according to claim 9, wherein the retention storage medium is anon-volatile storage medium.
 17. The ECU according to claim 12, whereinthe retention storage medium is a non-volatile storage medium.